CVE-2019-7249

In Keybase before 2.12.6 on macOS, the move RPC to the Helper was susceptible to time-to-check-time-to-use bugs and would also allow one user of the system (who didn't have root access) to tamper with another's installs.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2019-01-31

Last modified

2024-08-04

Weaknesses

CWE-367

Affected products

• Keybase (Keybase)

References

• http://www.securityfocus.com/bid/106824
• https://hackerone.com/reports/471739
• https://keybase.io/docs/secadv/kb004